Make webvulnscan a real module

Previously, we used a lot of incorrectly absolute imports.
This commit uses proper relative imports (and a module for webvulnscan) instead.